One post tagged with "motion-engine"

I'd like to spend this post inside the Motion Engine. The previous post showed a pipeline from the outside with ingesting syslog data, filtering 'deny' events, a 30-second aggregation rollup to Splunk, and sending raw to S3, which is enough to get started but hides the parts I'd like to mention here. What happens when the downstream systems (e.g. SIEM) slows down? What survives a restart? Why does a task that counts things behave differently from one that parses things?

Those answers live in two objects: streams and tasks. Both carry more configuration surface than they first appear to, and that surface is deliberate. The knobs below are what let the same binary sit at a branch office dropping what it must, or in a datacenter with a durable log and a replay window.